Security

Asterobot has no user accounts of its own: whoever reaches its port is treated as you. That's fine while it only listens on your own computer, and it's the one thing to keep in mind before you let other machines in.

Anyone who reaches Asterobot can do what you do

Asteroboard does everything through Asterobot's port, the one in server.listenAddress. Anyone whose browser or program reaches that port, and gets past basic auth when you've set it, can do all of it too:

• Read every setting, including website.token, the sign-in Asterobot uses for your asterobot.net account, and the basic auth passwords themselves.
• Use your Ankama accounts: connect bots with them, send messages in the game as your characters, and disconnect the game you're playing.
• Run code on your bots: install packages from the marketplace with your asterobot.net account, write new ones in the editor, and play them.
• Watch your games: read bot consoles, chat and traffic, including IdentificationRequest, the message that opens a game session, once they tick it.
• Change or delete anything: settings, bots, accounts, packages and game versions. That includes opening the MITM ports to the network, or turning basic auth off.
• Shut Asterobot down.

One thing stays out of reach. Asteroboard never receives your stored Ankama passwords or the Ankama sign-ins, so nobody can read them through Asterobot's port. They can still use them, by connecting your bots.

What the defaults protect

• Asterobot's port and the two MITM ports all listen on 127.0.0.1, which only the computer running Asterobot can reach. On a shared computer, that still includes the other people who use it, and every program running on it.
• The MITM ports only open while a bot waits for your game.
• config.toml, which holds the asterobot.net sign-in and the basic auth passwords, is only readable by your own user on Linux and macOS. Asterobot writes it that way, and when it finds the file open to others, it restricts it again and prints Restricted the configuration file to its owner.

There's no password and no HTTPS by default, because only this computer can reach those ports.

Before you open it

Go through this list before any other machine can reach Asterobot:

1. Prefer an SSH tunnel. It keeps Asterobot on 127.0.0.1, encrypts the connection and only lets in people who can sign in to the machine. It's also the only option that keeps MITM mode working. See Asterobot on a remote machine.
2. Otherwise, set basic auth, with a long password you don't use anywhere else.
3. Turn on TLS, so that password and everything else don't cross the network in a readable form.
4. Limit the port in your firewall to the devices that need it, and don't forward it from your router to the internet.
5. Open only what you use. Leave botmanager.mitmBindHost on 127.0.0.1 unless Dofus runs on another computer.
6. Check the result on Server > Status, from the device you connect with: Transport should read Encrypted (HTTPS), and Authentication should read Password protected.

Basic auth and TLS both stop MITM mode. When you need MITM mode with Dofus or Asteroboard on another machine, use SSH tunnels, or keep the setup on a network you trust, as MITM across machines does.

Basic auth

server.basicAuth holds user names and their passwords. When it holds at least one, Asterobot asks for a user name and a password on every request to its port, from every browser and program. It takes effect when Asterobot restarts. Asteroboard on another device shows how to set it.

What to know about it:

• The passwords are stored in plain text in config.toml, exactly as you typed them. Anyone who can read that file can read them, and so can anyone who gets in with one of them, on Server > Config.
• Nothing limits wrong guesses. Asterobot doesn't slow down or lock anyone out after failed attempts, so a long password matters.
• Without TLS, the password travels readable. The browser sends it with every request, and anyone who can watch the network between the browser and Asterobot can read it.
• It covers everything on the port, including the connection settings Dofus fetches in MITM mode. Dofus can't send a password, so MITM mode stops working.
• The browser asks for it when you open Asterobot's address, and Asteroboard then uses what the browser remembers. Browsers usually forget it when they close.

TLS

server.tls makes Asterobot's port speak HTTPS, so what goes between your browser and Asterobot can't be read on the way. It takes effect when Asterobot restarts.

• The certificate is self-signed, and it only covers localhost, 127.0.0.1 and ::1. Browsers warn about it the first time. Accept that warning only for the address of your own Asterobot.
• It's valid for 3 years, and Asterobot doesn't renew it. Asteroboard on another device explains where it's stored and how to replace it.
• It stops MITM mode, because Dofus fetches its connection settings over plain HTTP.

The MITM ports

The sign-in port (botmanager.mitmSignInPort, 5555) and the session port (botmanager.mitmSessionPort, 5556) exist for Dofus clients. They listen on botmanager.mitmBindHost, 127.0.0.1 by default, and only while at least one bot is waiting.

What they accept:

• The sign-in port takes any Dofus client that connects, and passes its sign-in on to Ankama. Asterobot asks for nothing: Ankama checks the account.
• A waiting bot that isn't attached to an Ankama account takes the first session that arrives, and attaches itself to that account. A bot without an Ankama account keeps that attachment for good.
• The session port only takes a game session whose ticket came through the sign-in port, and each ticket works once. Any other connection is closed.
• Port 8080 answers Dofus's request for connection settings with Ankama's public settings, where only the sign-in address is changed.

So when the MITM ports are open to a network, anyone on that network can send their own game through your Asterobot, and your waiting bot can end up attached to their account instead of yours. It then no longer takes your sessions: delete it and add it again (see MITM mode). Relaying a Dofus from another computer also means leaving port 8080 open without a password, with everything that allows.

If someone got in

If you think someone used your Asterobot without you:

1. Stop Asterobot, or set server.listenAddress back to 127.0.0.1:8080 and restart it.
2. Change the basic auth passwords, and every other place you used them.
3. In Account Manager, click Disconnect on each Ankama account: Asterobot asks Ankama to cancel the account's sign-in, then forgets it (Account status and actions). If passwords were stored, change them on Ankama's side.
4. Log out of asterobot.net from the account button, then sign in again. Logging out makes Asterobot forget its sign-in, but it doesn't cancel a copy someone else may have taken. Getting help explains how to reach the team.
5. Check Library Manager, Bot Manager and Server > Config for anything you didn't do.

Where to go next

• How the parts connect
• Accounts and safety